CVE-2013-2852 is a format string vulnerability in the Broadcom B43 wireless driver (b43_request_firmware function) within the Linux kernel, affecting various distributions including Canonical and Debian. This flaw allows a local attacker with root access to escalate privileges by manipulating the 'fwpostfix' modprobe parameter with format string specifiers, leading to improper error message construction. The vulnerability has a CVSS score of 6.9, indicating high severity with local access, medium attack complexity, and complete confidentiality, integrity, and availability impacts. While not listed on the KEV catalog, an exploit (EDB-38559) exists on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.12, < 3.0.83CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.1, < 3.2.47CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.3, < 3.4.50CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.5, < 3.9.7CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:M/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.